Stop Treating Coding Agent Plugins Like Settings: Introducing Agent Plugins Repositories

Agent plugins, often installed by developers from unmanaged sources like GitHub, present significant security challenges due to the lack of versioning, provenance, and audit trails, making them susceptible to supply-chain attacks. These plugins, which bundle execution capabilities, credentials, and more, run directly on developers' machines, potentially executing arbitrary shell commands without alerts or traceability. The distinction between version control systems like Git and package registries is crucial, as the former does not provide the necessary immutability and governance needed for managing plugins as dependencies. JFrog Artifactory's Agent Plugins local repositories address these issues by integrating plugins into existing pipelines, offering signed, immutable releases, unified access control, comprehensive audit trails, and security scanning. This approach mirrors the governance applied to npm packages and Docker images, ensuring that agent assets are managed with the same rigor, thereby minimizing the risk of supply-chain incidents and promoting a secure development environment.